CVE-2026-53851CWE-862

OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass

Medium · published June 16, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-16T18:05Z
EPSS history
Timeline
  • 16 JUN 18:05Z
    OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass
    cvelistv5